Red Hat Security Advisory

RHSA-2025:15036

httpd security update

Released 2025-09-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) httpd-2.2.15-71.el6_10.1, httpd-devel-2.2.15-71.el6_10.1, httpd-manual-2.2.15-71.el6_10.1 +2

Fixes 1 record

TI-2025-31736 CVE-2025-49812 · GHSA-2mcx-3xj5-wg86

Apache HTTP Server: mod_ssl TLS upgrade attack

LOW 35

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00614 Published 2025-07-10 Fixed CWE-287